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Great scientific discoveries have been made by men 
seeking to verify quite erroneous theories about the nature of things. 

- Aldous Huxley 



Abstract 

Motivated by certain applications from physics, biochemistry, economics, and computer science in 
which the objects under investigation are unknown or not directly accessible because of various limi- 
tations, we propose a trial-and-error model to examine search problems in which inputs are unknown. 
More specifically, we consider constraint satisfaction problems /\ i C% , where the constraints Ci are hid- 
den, and the goal is to find a solution satisfying all constraints. We can adaptively propose a candidate 
solution (i.e., trial), and there is a verification oracle that either confirms that it is a valid solution, or 
returns the index i of a violated constraint (i.e., error), with the exact content of C; still hidden. 

We studied the time and trial complexities of a number of natural CSPs, summarized as follows. 
On one hand, despite the seemingly very little information provided by the oracle, efficient algorithms 
do exist for Nash, Core, Stable Matching, and SAT problems, whose unknown-input versions are 
shown to be as hard as the corresponding known-input versions up to a factor of polynomial. The 
techniques employed vary considerably, including, e.g., order theory and the ellipsoid method with a 
strong separation oracle. 

On the other hand, there are problems whose complexities are substantially increased in the 
unknown-input model. In particular, no time-efficient algorithms exist for Graph Isomorphism and 
Group Isomorphism (unless PH collapses or P = NP). The proofs use quite nonstandard reduc- 
tions, in which an efficient simulator is carefully designed to simulate a desirable but computationally 
unaffordable oracle. 

Our model investigates the value of input information, and our results demonstrate that the lack 
of input information can introduce various levels of extra difficulty. The model accommodates a wide 
range of combinatorial and algebraic structures, and exhibits intimate connections with (and hopefully 
can also serve as a useful supplement to) certain existing learning and complexity theories. 
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1 Introduction 



In a broad sense, computer science studies computation and other information processing tasks. Theoreti- 
cal computer science, in particular, focuses on understanding the ultimate power and limits of computation 
in various models. A central question in theoretical computer science is to find the minimum cost of an al- 
gorithm for computing a function / on inputs x. Algorithm design and computational complexity analysis 
assume that the input is given explicitly. However, in many scenarios, we actually lack input information. 

• In a normal-form game, it is usually assumed that the payoff function of every player is given 
explicitly (or can be computed easily in a certain way). However, in many circumstances, players do 
not necessarily know their payoffs or possible strategies, particularly when they are exploring a new 
environment (such as a new business model). In some cases, they may not even know the number 
of other players, let alone their strategies {36]. 

• In a two-sided matching marketplace, every individual has a preference over the agents of the other 
side. However, the individuals themselves may not know their (precise) preferences. For example, 
in a job market, an applicant may not know precisely how much he or she would like the job in 
question because of a lack of information about the nature of the job, the company culture, and his 
or her future relations with colleagues. At the same time, it is generally quite difficult for recruiters 
to judge which candidates best fit the position. Indeed, decision makers quite often make hiring 
mistakes: "... a systematic and continuous approach to fitting the right person to the right job at 
the right time has long been the Holy Grail of workforce organization" [2j. 

• In the event of an infectious disease outbreak, due to an unknown virus, biochemists need to find 
diagnostic reagents that have no serious side effects. In a simplified formulation, this involves a 
search for a reagent that satisfies a collection of constraints (e.g., one constraint may be that the 
reagent should not contain certain medical ingredients composed in a certain way, as otherwise, its 
reaction with the virus could cause a severe headache). If the biochemists knew everything about 
the virus (e.g., its DNA sequence, chemical composition, etc.), then it would be much easier for 
them to find a diagnostic reagent. If the virus is largely unknown, however, then they are left with 
an effectively unknown-constraints formula to satisfy. Of course, they could try to employ modern 
DNA technologies to gain most information on the virus, but doing so usually takes a long time, 
and identifying a diagnostic reagent to control the ensuing pandemic is a matter of urgency. 

In summary, an input, while it exists, may be unknown because of our limited knowledge and control of 
the system, or of our lack of experience in a new environment. There are numerous other scenarios with un- 
known inputs, e.g., animal behavior studies, neural science, and hidden web databases, to name just a few. 

1.1 Trial and Error 

Trial and error is a basic methodology in problem solving and knowledge acquisition, and it has also been 
used extensively in product design and experiments [56 . Generally speaking, the approach proceeds by 
adaptively posing a sequence of candidate solutions and observing their validity. If a proposed candidate 
solution is found to be valid, then the mission is accomplished. Otherwise, an error is signaled from one of 
the characteristics of the studied object. An important feature of the approach is its solution orientation: 
the goal is to find one solution, with little care paid to other considerations such as why the solution 
works pQ. 
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Trial and error is also a commonly used approach in the aforementioned examples. In economics, 
individuals adopt and adaptively adjust their strategies based on observed market reactions. Such self- 
motivated, but self-regulating, types of behavior, as implied by Adam Smith's "invisible hand" theory, 
can converge to a socially desirable state (even without the individuals involved having any knowledge of 
one another). In a company, an employee will usually look for a more suitable position when dissatisfied 
with his or her current one, and senior management will usually encourage personnel adjustments to 
enhance performance. Biomedical scientists conduct clinical trials to test their designed reagents, and if 
an unacceptable side effect is observed, then they collect and analyze feedback data to help with future 
diagnostic reagent tests [39|. 

The most critical ingredient in the trial and error approach is how to employ previously returned 
errors to propose future trials. This procedure is algorithmic in nature, but it does not seem to have been 
formally addressed from an algorithmic perspective. This paper aims to investigate this approach on a 
broad category of problems with unknown inputs. 

1.2 Model and Preliminaries 

Motivated by the foregoing examples, we investigate the effects of the lack of input information from a 
computational viewpoint on the basis of the trial and error approach. The central question we consider 
is the following. 

How much extra difficulty is introduced due to the lack of input knowledge? 

In this paper, we explore this question in search problems. Suppose that on an input (instance) /, 
there is a set S(I) of solutions. A search problem is to find a solution s G S(I) to input /|H Numerous 
problems arising from a variety of applications studied in algorithm design and computational complexity 
are search problems. Typical examples include searching for a Nash equilibrium in a multi-player game, 
searching for a satisfying assignment in a conjunctive normal form (CNF) formula, and finding a stable 
matching to pair individuals with preferences in a two-sided market. 

All of these problems, in addition to the motivating examples discussed earlier, naturally fall into the 
broad category of constraint satisfaction problems (CSPs). Suppose that there is a space Q = {0,1}™ of 
candidate solutions. Corresponding to an input /, there are a number of constraints C±, Co, . . . , C m (, . . .), 
where each Cj C {0, l} n is a relation on the solution variables defined on given domainso The solutions 
of I are defined as those s that satisfy all constraints Cj, i.e., s £ fljCi- Note that the number of 
constraints can range from constant to polynomial, exponential, or even infinite. CSPs are a subject of 
intensive research in theoretical computer science, artificial intelligence, and operations research, and they 
provide a common basis for exploration of a large number of problems with both theoretical and practical 
importance. 

This paper addresses the situation in which the input I is unknown. For a search problem A, we denote 
by A u the same search problem with unknown inputs. For example, in the StableMatching problem, the 
input contains the preference lists of all men and women; in StableMatching u , these preference lists are 

x One might wish to find more or even all solutions. Here, we follow the standard requirement for searching problems in 
complexity theory [33, 7 by asking for only one (arbitrary) solution. 

2 Note that it is possible for a problem to have different CSP definitions, which, depending on the available set of tools, 
may in turn lead to different complexities for solving the problem. For example, to identify an unknown substance, we can 
employ different (physical, chemical, etc.) test methods, which, in general, require different costs. This phenomenon reflects 
the intrinsic variety of a problem and the diversity of its solutions. Thus, to define an unknown-input problem, we need to 
indicate explicitly its corresponding CSPs. For the problems investigated in this paper, we arguably use their most natural 
definitions. 
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unknown to us. The constraints are that all man-woman pairs (m, w) are not blocking pairs, and the task 
is to find a solution that satisfies all constraints, namely a stable matching [32] . 

Similar to the way in which a biochemist proposes a chemical reagent and then performs clinical tests, 
here our method of searching for a solution of a CSP is also the trial and error approach. We propose 
a candidate solution s: If s is not a valid solution, then we are told so by a verification oracle V, and, 
what is more, V also gives us the index of one constraint that is not satisfied. Otherwise, s satisfies all 
constraints, and then we cannot observe any violated constraint; equivalently, V returns a confirmative 
answer, and our job is done. Some remarks are necessary: 

• If more than one constraint is violated, then (the index of) any one of them can be returned by 
V. We make no assumption about which one, not only because worst-case analysis is standard in 
algorithm and complexity studies, but also because in many applications, such as drug tests, the 
verification oracle is carried out by Nature or human bodies, and thus how and which violation is 
returned is truly beyond our current understanding. 

• Note that V does not reveal the constraint itself, but only its index or label. For example, we know 
something like "the third constraint is violated" in the proposed assignment of the SAT U problem, 
or "the second player has a better mixed strategy" for the proposed strategy in the Nash u problem, 
but the exact content of the constraint (i.e., the literals in the clause of SAT U or the player's utility 
function of Nash u ) is still unknown to us, which is consistent with our motivating examples. If 
a headache is observed in a drug development clinical trial, then we do not always know which 
components of the proposed reagent caused the problem: We have only a label of "headache" for 
the proposed reagent. 

Surprisingly, despite this seemingly very little information and the worst-case assumption on the verifica- 
tion oracle, we still have efficient algorithms for many problems. 

Given the verification oracle V, an algorithm is an interactive process with V. We choose candidate 
solutions (i.e., trials), and the oracle returns violations (i.e., errors). The process is adaptive, i.e., the 
newly proposed solution can be based on the historical information returned by the oracle. 

Because our focus is on how much extra difficulty is introduced by the lack of input information for 
a search problem A, we single out this complexity by comparing the unknown- input and known- input 
scenarios. To this end, we equip our algorithms with another oracle, the computation oracle, which can 
solve the known-input version of the same problem A. Overall, our algorithms can access two oracles, the 
verification oracle and the computation oracle (we do not allow them to invoke each other). 

As is standard in complexity theory, a query to either oracle has a unit time cost. The time complexity 
of a problem with unknown inputs is the minimum time needed for an algorithm to solve it for all inputs 
and all verification oracles consistent with the input. We employ the standard notation in computational 
complexity theory for complexity classes such as P and NP and also for oracles. For example, A u G p v > A 
means that problem A u can be solved by a polynomial-time algorithm with verification oracle V and the 
computation oracle that can solve the known-input version of A. If this occurs, then we consider the extra 
complexity (resulting from the unknown input) not to be very high. The central question can therefore be 
translated to the following. Given a search problem A, is A u G P V,A ? If the given known-input problem 
A is in P, then the computation oracle can be omitted, and the problem becomes "Is A u G p v ?" 

We also define the trial complexity of an unknown-input problem A u as the minimum number of queries 
to the verification oracle that any algorithm needs to make, regardless of its computational powero As is 

3 It is thus the "query complexity" to the verification oracle. Here, we adopt the term "trial complexity" to avoid any 
potential confusion of the two types of oracle queries (corresponding to the two oracles). 
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standard in query complexity theory, we can consider deterministic or (Las Vegas) randomized algorithms. 
The latter can be assumed to be error-free because of the verification oracle V, and we count the cost as 
the expected number of queries to V. We denote by D(A U ) and R(^4 U ) the deterministic and randomized 
trial complexities of A u , respectively. 

We investigate trial complexity not only because it provides a rigorous proof of computational hard- 
ness, but also because it measures the number of trials (or in another perspective, errors) that must be 
undertaken to find a solution. Note that in many scenarios, such as diagnostic reagent development, 
trials constitute the major expense, both financially and temporally, and in almost all of the motivating 
examples discussed earlier, an important goal is to design protocols or experiments with a small number 
of trials. 

1.3 Our Results and Techniques 

We consider a number of problems, that are motivated by the aforementioned examples, to investigate 
the trial and time complexities resulting from the lack of input knowledge. (The formal definitions of 
these problems and their natural formulation as CSPs are deferred to subsequent sections.) 

Theorem 1. For the following problems A, we have A u £ P V ' A . 

• Nash: Find a Nash equilibrium of a normal-form game. 

• Core: Find a core of a cooperative game. 

• StableMatching: Find a stable matching of a two-sided market with preferences. 

• SAT: Find a satisfying assignment of a CNF formula. 

Nash is a fundamental problem in game theory, and its complexity has been characterized (as PPAD- 
complete) [261 [23] . Core is also a fundamental problem in cooperative game theory [59j . Both problems 
are naturally defined as CSPs. Our algorithms for both Nash u and Core u employ the ellipsoid method, 
although for Nash u we shrink the input space, and for Core u we shrink the solution space. One technical 
difficulty is that the target space may degenerate to the case of containing at most one point. (In Nash u , 
there is only one input point, and in Core u the core may contain only one point or even be empty.) Note 
that the standard perturbation approach, which proceeds by increasing the volume of the feasible region, 
is not applicable in our setting, because the linear constraints, as the input, are unknown. Here, we employ 
a more sophisticated ellipsoid method that works as long as the polyhedron can be specified by a strong 
separation oracle. As it turns out, this oracle can be constructed from the verification oracle V in both 
problems, and, crucially, the construction for Nash u uses the existence of a Nash equilibrium in any game. 

StableMatching is a problem with interesting combinatorial structures and many applications, such as 
the pairing of graduating medical students with hospital residencies [661 [65], SAT is a natural CSP, with 
the constraints being the OR of some literals. Considering the practical significance of StableMatching 
and SAT, we take a closer look at their trial complexities. 

Theorem 2. We have the following bounds for the trial complexity. 

• Q(n 2 ) < R(StableMatching u ) < D(StableMatching u ) < 0(n 2 logn), where n is the number of agents. 

• Given a formula with n variables and m clauses, R(SAT U ) 



< D(SAT U ) = O(mn). Further, R(SAT U ) = fi(mn) if m = ft(n 2 ), and R(SAT U ) = ft(m 3 / 2 ) if 
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The proofs of both lower bounds deviate from the standard method of applying Yao's min-max prin- 
ciple. Rather, they are obtained by arguing that, for an arbitrary but fixed randomized algorithm with 
an insufficient number of queries, there are input instances with disjoint solution sets between which the 
algorithm cannot distinguish. The existence of such input instances is proved by the probabilistic method 
for StableMatching u , and by an adaptive construction procedure for SAT U . 

The upper and lower bounds proofs for R(StableMatching u ) also employ order theory |18|, I27j. A key 
step is to characterize how fast one can shrink the set of linear orders consistent with a partial order by 
worst-case pair violations. We identify the average height as the correct measure; the control of which 
allows us to bound the speed of the shrinkage. Along the way, we examine another natural problem, 
Sortingu, whose trial complexity is completely pinned down as B(nlogn). 

It is somewhat surprising that knowing only the indices of violated constraints is already sufficient to 
admit quite a number of efficient algorithms. It is therefore natural to wonder whether the lack of input 
information adds any extra difficulty at all in finding a solution. We find that it does indeed: there are 
problems whose unknown-input versions are considerably more difficult than their known versions. Two 
representatives are Graphlso and Grouplso, the problems of deciding whether two given graphs or groups 
are isomorphic. 

Theorem 3. We have the following hardness results. 

• //Graphlso u € p v > Gra P hlso ; then the polynomial hierarchy (PH) collapses to the second level. 

• If Grouplso(-, 'Lp) u £ P v , then we have P = NP. Here, Grouplso(-, Z p ) is the group isomorphism 
problem with the second group known as Z p for a prime p. 

However, z/SAT is given as the computation oracle, then we have deterministic polynomial-time algorithms 
for Graphlso and Grouplso, i.e., Graphlso u € p v > SAT an g Grouplso u € p v > SAT ; with 0(n 6 ) andO{n 2 ) trials, 
respectively. 

Note that Grouplso(-, Z p ) (with a known input) admits a simple polynomial-time algorithm by com- 
paring the multiplication tables. Actually, Grouplso is in P if the two groups are Abelian [13]. However, if 
the multiplication table of the input group is unknown, then, surprisingly, the problem becomes NP-hard. 
Interestingly, this substantial increase in computational difficulty occurs only for time complexity, not for 
trial complexity, which can be seen as a tradeoff (from below) between the two complexity measures — a 
phenomenon not commonly seen in other query models. 

This hardness result for Grouplso(-, Z p ) u is proved by a nonstandard reduction from the classic NP- 
complete problem of finding a Hamiltonian cycle. We use an algorithm A for Grouplso(-, Z p ) u to find a 
Hamiltonian cycle in a given graph G in the following way. Assuming the existence of a Hamiltonian cycle 
C, which does not change the NP-completeness of the problem, we define a group H via C and run A on 
input (H, Z p ). An issue here is that because the reduction algorithm has only polynomial time, it cannot 
find such a Hamiltonian cycle for defining H. A related issue is how to provide the verification oracle V 
for A without knowing C. These issues can be overcome by (i) making use of the crucial property that A 
does not know its input, and (ii) designing an efficient simulator V for the verification oracle V. Due to 
the time constraint, V" cannot perfectly mimic V to answer all of A's questions correctly. However, it is 
designed with the favorable property that whenever it produces an incorrect answer, a Hamiltonian cycle 
in G has just been found. («4's correctness on H may already have been compromised, but we are not 
further concerned with it. We simply use *4's code to serve the purpose of finding a Hamiltonian cycle in 
G.) 
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Finally, beyond all of the foregoing problems that can be solved in P v ' bA ',we show via an information 
theoretical argument that certain other problems, such as Subset Sum, have an exponential lower bound 
for the randomized trial complexity. 

Theorem 4. R(SubsetSum u ) = 0(2"). 

In a followup work p3], we showed that solving an unknown linear programming with m constraints 
and n variable requires f2(m n/ ' 2 ) queries to the oracle, i.e., it also has an exponential lower bound on the 
trial complexity. This result implies that our efficient algorithm solving Nash u does not completely resort 
to the computation oracle Nash: it is indeed the combinatorial structure of Nash equilibrium (i.e., its 
existence) that yields our algorithm. See more discussions in |14| . 

Our results illustrate the variety of time and trial complexities that arise from the lack of input 
information for different problems, and imply distinct levels of the cruciality of input information for 
different problems. 

In addition to the specific techniques previously mentioned for each problem, a general remark is 
that, at a very high level, our algorithms are in line with the candidate elimination approach, similar to 
many existing learning algorithms [2B]. However, our framework allows a space for possible inputs and a 
space for possible solutions — the interplay between them seems to be the main source of combinatorial 
structures, and how well the two spaces are combinatorially related accounts for the complexity of the 
problem. Some algorithms (e.g., that for Core u ) obtain their efficiency by directly shrinking the solution 
space. Even for those that shrink the input space (e.g., those for SAT U and Nash u ), the key is to explore 
the relation of the two spaces and to design trials such that even a worst-case violation can be used to 
cut out a decent fraction of the input space. 

1.4 Relation to Existing Work 

Our model with unknown inputs bears a resemblance to certain other problems and models, e.g., learning, 
algorithm design in unknown environments, ellipsoid method, and query complexity. However, there are 
fundamental distinctions between these models and ours. We now provide a detailed discussion of our 
work's relation to these models and problem. 

Learning. Our model has strong connections to various learning theories, but fundamental differences 
also exist. 

1. Learning theories, in essence, aim to identify the unknown object itself, either exactly (as in concept 
learning) or approximately (sometimes in the form of a prediction, as in PAC learning and active 
learning). In our model, however, the ultimate goal is quite different: we attempt only to find a 
solution of an unknown object, without necessarily learning the object itself. For certain applications 
(such as the aforementioned development of diagnostic reagents), finding a solution is indeed the 
main mission. 

2. It is important to note that in our model, a solution may be found long before the exact input is 
learnt. Further, in certain cases, such as SAT U and Nash u , the exact input may take an exponential 
number of queries or even be impossible to learn. For SAT U , even if we relax the requirement by 
allowing to output any formula within a cluster in which all formulas have the same set of satisfying 
assignments as the hidden input formula, it is still exponentially harder than finding a solution 
(Proposition [9]). Our algorithm, in contrast, is able to find a solution in polynomial time without 
learning the exact input formula. 
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3. Both similarities and differences abound in existing learning theories, and deciding which one to use 
in a specific application largely depends on the available method of accessing the unknown. As we 
have demonstrated, there are a fairly large number of scenarios in which the only available access 
to the unknown is provided by the verification oracle, but existing learning theories do not seem to 
address such situations. 

In summary, with its solution-oriented objective and advantages in computational efficiency, the present 
work is hopefully to serve as a useful supplement to existing learning theories, particularly in contexts in 
which the unknown object itself is impossible or unaffordable to learn and the only available access to the 
unknown is through a solution- verification process. 

Next we give a detailed discussion on the relationship between our model and relevant learning theories. 

• Concept learning. In concept learning, a concept is secretly drawn from a given concept class, and 
the task at hand is to identify it; see the survey by Angluin [5j. More precisely, given a domain 
set X an d a collection C of concepts, each c G C maps X — > {0,1}, defining a table with rows 
C and columns X. Further, there is an unknown concept c* G C. To identify the row/concept c*, 
two types of queries are commonly used: (i) a membership query, where one queries a particular 
column/domain element x £ X, and an oracle returns its value c*(x), and (ii) an equivalence query, 
where one proposes a particular row/concept c G C, and an oracle returns either a confirmative 
answer or a column/domain element x with c(x) 7^ c*(x). If the proposed concept c is allowed to 
be any mapping from X to {0, 1}, then it is called an extended equivalence query. 

Despite having some similar features, our model cannot be cast into the membership or equivalence 
query frameworks. For a search problem, we can take the set of inputs as the concept class C, take 
all possible solutions as the domain X, and let c{x) = 1 if and only if x G X is a solution of the 
instance c. A membership query is thus similar to our model in that ours also proposes solutions 
x G X. However, the goal in our problem is to find a solution x that satisfies c*(x) = 1, where c* 
is the hidden input, whereas the task in the membership query model is to identify the concept c*. 
The second important difference is that other than knowing whether or not a proposed solution is 
valid, in our model, we also gain extra information on the index of a violated constraint. Both this 
extra information and the feature of not necessarily learning the input enable us to obtain (more) 
combinatorial structures and to design efficient algorithms. 

Alternatively, we can take the solution space as C and the set of constraints (corresponding to an 
input instance) as X; then, our problem is to find a solution c that satisfies c{x) = 1 for all x G X, 
i.e., all constraints are satisfied. Our trial and error model then becomes similar to the equivalence 
query model: each time we propose a solution c and an oracle returns a violated constraint x where 
c(x) = 0. However, note that different input instances correspond to different sets of constraints, 
and thus induce different (C, X) tables. As a result, there are actually many such tables in our 
model, and we do not know which one we are faced with. Our task is still to find a row (i.e., a 
solution) in which all entries are 1 in the hidden table, and the algorithm needs to succeed for any 
of the possible input tables (C, X). Thus, both the unknowns and objectives of the two models are 
entirely distinct. 

We could also put all of the possible constraints together to form a much larger table, with the 
rows indexed by all possible solutions c G C and the columns indexed by all possible constraints 
x G X, with c(x) = 1 if the solution c satisfies the constraint x, and c(x) = otherwise. This 
approach would produce only one fixed table (as in concept learning), but the hidden input would 
now correspond to a hidden subset of columns. When a violation x is returned, it is not the identity 
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of a column of the large table, but the column's relative position inside the hidden subset of columns. 
Further, the required task is also different. In the equivalence query model a row is to be identified, 
whereas in our model we are asked merely to return one row c G C that satisfies c(x) = 1 for all x 
from the hidden subset of columns. 

In addition, even more differences exist between our model and concept learning. In our model, a 
search problem instance may have several different solutions; thus, the correct output of an algorithm 
is not unique. However, in concept learning, the return of an algorithm has to be the unique hidden 
input c*. Another difference lies in the complexity measure. In concept learning, the cost of an 
algorithm is measured in terms of \C\ and |A|. In our model, in contrast, the complexity is evaluated 
in terms of the input size of the search problem, rather than the size of the solution space, which 
can be exponential or even unbounded. 

• Active learning. A more general type of query learning model is active learning. Roughly speaking, 
there are two sets, L and U, whose data are labeled and unlabeled, respectively. Based on labeled 
set L, a learning algorithm interactively queries an oracle concerning certain data instances from 
unlabeled set U. The oracle then returns the labels of the queried data, which are added into L. See 
the survey by Settles [69J for a more detailed discussion. There are a number of similarities between 
active learning and our model. For example, both consider an iterative and adaptive process that 
involves posing selected queries to a given oracle, and both investigate the complexity of interacting 
with this oracle \25\ 111]. However, the two oracles are fundamentally different. In active learning, 
the oracle always returns the correct answer (i.e., label), whereas in ours it always returns one of 
the erroneous constraints. In addition, the objective in active learning is to achieve a high degree 
of accuracy (for the prediction of the data in unlabeled set U) using as few labeled instances as 
possible, which is very different from the objective in ours. 

• PAC learning. Another slightly related model is Valiant's probably approximately correct (PAC) 
learning model [71], in which from a probability distribution D over the domain set X, we can 
sample instances and be told whether or not they are supported by the unknown concept. Based on 
the training samples (the minimum number of which is called the sample complexity), the objective 
is to propose a concept (called a hypothesis) that approximates the unknown concept with a small 
probability of error (which can be used to predict future samples). Classic examples include DNF 
learning [40] HH [20] and halfspace learning [ITJ HU [49] . As in concept learning, PAC also aims to 
learn the unknown itself (although an approximation is allowed) rather than an induced solution, 
as in our model. 

There are also many other learning models, e.g., decision tree learning, reinforcement learning [12J, 
statistical learning [73], (semi-)supervised learning [10J, and learning with errors [64] ; see [46|. [54] and 
the references therein for a more detailed discussion. The high-level philosophy of these models is also 
"sample and predict" , which is very different from our trial and search (for a solution) . 

Algorithms in an unknown environment. Theorists have addressed the exploration of an unknown 
environment in several domains. In robot exploration and navigation, a robot is placed in an unknown 
geometric terrain with obstacles [I5l [28l ETJ HJ [38] or a graph with unknown edges [29j EOj EJ [3] , and the 
robot's goal is to explore the entire unknown space starting from a given point. A similar problem is path 
planning, where again we are given an unknown environment, but the objective is to find a desired path 
between two specific locations in either graphs [63] or geometric spaces [52l [53], [6] . Readers are referred 
to [55] for a survey of these topics and results. A feature our model has in common with these is that 
the input object under study is unknown. However, as opposed to the proposal of entire solutions in 
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our model, solution finding in the robot exploration and path planning models takes place via a "local 
search" type approach, where an agent looks for the next move on the basis of his or her current location 
and historical information. Despite being a very natural model for these applications, it seems difficult 
to generalize to scenarios without an underlying geometric structure. 

Ellipsoid method. Our trial and error search model is, in spirit, similar to the ellipsoid method (see, 
e.g., [35]), in which a point is proposed as a trial, and a separating hyperplane is returned as an error. 
The ellipsoid method is an elegant approach for proving the polynomial time solvability of a class of 
combinatorial optimization problems; it applies even when the explicit expressions of the constraints are 
unknown. However, our trial and error model includes a much broader class of search problems — not only 
convex optimization problems, but also many with pure combinatorial structures (e.g., the SAT, Grouplso, 
and Graphlso problems considered in our paper). From this perspective, the ellipsoid method is only 
one possible approach for the trial and error search problems in our model. (Indeed, the algorithms for 
the Core u and Nash u problems considered herein are built crucially on the ellipsoid method; but we also 
employ other approaches to solve other problems, including SAT U and StableMatching u .) In addition, even 
if a problem can be solved using an ellipsoid-based approach, its trial and time complexities may be quite 
large (e.g., the ellipsoid method cannot compete with the simplex algorithm for practical calculations). 
Therefore, for problems with numerous applications, e.g., StableMatching u , a more efficient (combinatorial) 
algorithm is desirable (note that a stable matching instance can be written by a linear program [72]). 

Complexity. In the query model (also known as decision tree model), an algorithm makes queries in the 
form of u Xi =?", and the task is to compute a function / on the unknown x by the minimum number of 
queries |22j. Although this area has the same flavor of computing a function without learning all input 
variables, it is quite different from our model in the form of queries allowedQ Therefore, our results on 
trial complexity can be viewed as an extension of the traditional query model by allowing a much larger 
class of queries with natural motivations. 

In some cryptographic tasks, input instances are hidden from one party. For example, in instance- 
hiding proof systems [13j . the verifier tries to compute a function / on input x by interacting with one 
or more provers, without leaking any information on x to the prover(s). Although this model is clearly 
very different from ours, an interesting research direction would be to explore the connections between 
our model and various cryptographic tasks. 

2 Stable Matching 

In a Gale-Shapley two-sided matching market model [32J, we are given a set of men M and a set of women 
W, where \M\ = \W\ = n. Each man m E M has a strict and complete preference list^ denoted by >- m , 
ranking all the women in W, where w\ >~ m W2 means that m prefers w\ to W2- The preference list >- m is 
assumed to be transitive (i.e., if w\ >~ m W2 and W2 >~ m W3, then wi >~ m W3). The preference list >~ w of 
every woman w £ W is defined similarly. 

Given a matching between M and W, denoted by ^, we say that m £ M and w £ W form a blocking 
pair if both prefer each other to their matched partner in /x, i.e., w >~ m fi(m) and m >~ w n(w), where 
fi(m) and n(w) are the woman matched to m and the man matched to w in /U, respectively. Matching [i 

4 Other forms of queries were also considered, such as those in linear decision trees and algebraic decision trees, but they 
are still in a very restricted form of queries. 

5 We follow the model proposed by Gale and Shapley in their seminal work [32], where the number of men and women is 
the same, and every individual's preference is assumed to be complete and strict. All of these assumptions can be removed 
in our results, but for simplicity of exposition, we will adopt Gale and Shapley's original model. 



9 



is called stable if it contains no blocking pair. The StableMatching problem is to find a matching that is 
stable, namely, a matching that satisfies the following set of constraints, labeled by man-woman pairs. 

Either fJ,(m) y m w or fi(w) y w m, Vm G M, w £ W. (1) 

A stable matching always exists, and can be computed by Gale-Shapley's deferred acceptance algorithm 
in time 0(n 2 ). 

In the unknown- input version of the stable matching problem, denoted by StableMatching u , we do not 
know the preference lists y m and y w . What we can do is to propose candidate matchings as potential 
solutions. If a proposed matching is indeed stable, then the verification oracle V returns Yes, and the 
problem is solved. If it is not stable, then one constraint (i.e., a blocking pair) is revealed by V. Our first 
result is an 0(n 2 log n) upper bound on the randomized trial complexity of StableMatching u . 

Theorem 5. There is a polynomial-time randomized algorithm solving StableMatchingu with 0(n 2 logn) 
trials. 

Before describing the idea underlying the proof of this result, we first look at the unknown-input 
version of another basic problem, Sorting, which has a close relationship with StableMatching. In Sorting u , 
there is a set of n elements S = {at, a2, ■ ■ ■ , a n } in some underlying linear (total) order y, but this order 
is unknown to us, and the task is to discover it. We can propose a linear order (a^a^, . . . , afc n ) each 
time. If it is indeed the desired hidden total order, i.e., y ak 2 y ■ ■ ■ y ak n , then the verification oracle 
returns Yes, and the problem is solved; otherwise, a pair of elements (a, b) is returned such that a is before 
b in the proposed order, whereas b y a in the actual order. 

It is well known that the time complexity of a comparison-based sorting problem is B(nlogn). Note 
that this time complexity for Sorting is completely different from our trial complexity for Sorting u . In the 
following, we will show that the trail complexity bound for Sorting u is actually also 0(nlogn). 

Lemma 6. Sorting u can be deterministically solved using 0(n log n) trials, and the running time can be 
made polynomial for randomized algorithms. Meanwhile, any randomized algorithm that solves Sorting u 
needs at least Vt{n\ogn) trials, even with unbounded computational power. 

Idea of the proof. The upper and lower bounds for R(Sorting u ) both use order theory |18t 127] . Both 
bounds critically depend on how fast the set of complete orders consistent with a partial order can be 
shrunk by worst-case pair violations. Due to the distinction of the oracles in the standard comparison 
model and in ours, the techniques in the comparison model do not straightforwardly carry over to solving 
our problem. It turns out that controling the measure of average height allows us to bound, in both 
directions, the worst-case shrinkage speed in our model. Although the average height is #P-complete to 
compute [19] , fortunately, we can efficiently estimate this value to a sufficient degree of precision by using 
a fully polynomial randomized approximation scheme (FPRAS) for another related problem [301 121j . □ 

Formal Proof of Lemma® First, we define the notation as follows. A partially ordered set (or poset) is 
a set S equipped with an irreflexive transitive relation >. A linear extension of a poset (S, >) is a linear 
order y over set S such that a y b whenever a > b in S. For any given poset (S, >) and elements a,b G S, 
we denote by Pr(a y b) the probability of a y b where y is chosen uniformly at random among linear 
extensions of (S, >). 

In the Sorting u problem, suppose the unknown order is y* . Notice that for each of our proposed orders 
y, the verification oracle returns a pair of elements a, b £ S, from which and y, we can infer the relation 
between a and b in the actual order >-*. Thus, at each point of the algorithm, the information collected 
so far forms a poset (S, >), of which the underlying unknown order y* is a linear extension. 
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For any poset (S, >), we call an order (a& i; a& 2 , . . . , dk„) good if there is a constant c < 1, such that for 
any i < j, we always have Pr(a&. >- a^.) < c. Note that this is a very strong condition because it requires 
a constant shrinkage for all possible pairs The idea of solving Sorting u is that, at each step of the 

algorithm when our collected information forms a poset (S, >), we propose a good order if it exists. The 
property of a good order guarantees that whatever the verification oracle returns, we can always reduce 
the number of candidate linear extensions by a constant fraction c. Note that at the beginning of the 
algorithm, the number of candidate linear extensions is n\ as we do not have any information about >-*. 
And at the end of the algorithm the unique order y* is found and thus the number of linear extensions 
is 1. Therefore, the problem Sorting u can be solved in polynomial time and by C^log^n!) = 0(n log n) 
trials to the verification oracle, provided that 

1. for any poset (S, >), a good order always exists, and 

2. we find a good order in polynomial time. 

Next we shall address how to satisfy these two conditions. Given a poset (S, >) and an element a £ S, 
define its average height h{a) to be the average rank of a in all linear extensions of (S, >), where the rank 
of a in a linear extension >- is the number of elements b such that b >~ a. It is easy to see that the average 
height of elements in S are all rational numbers between and n— 1. Kahn and Saks [42j showed that for 
any pair of elements a,b € S satisfying h(a) — h{b) < 1, we must have Pr(6 >- a) < yt. Thus, for any poset 
(S, >), if we sort all elements of S in order (afc x ,afc 2 , . . . ,Ofc n ) such that h(ak 1 ) < h(cik 2 ) < ••• < h( a k n ), 
then for any % < j we will have h(ak i ) — /i(afc ) < < 1, and thus Pr(a/ Cj y a^J < yy. This implies that 
this is a good order as we want. 

Therefore, it remains to compute h(a) efficiently for every element a. However, it was shown in [19J that 
counting the number of linear extensions of a given poset is #P-complete, and determining the average 
height of an element of a poset is polynomially equivalent to the linear extension counting problem, thus 
is also #P-complete. Luckily, to our purpose of having a good order, an approximation of h{a) to a small 
enough precision suffices. To this end, we first notice that there exists a fully polynomial randomized 
approximation scheme (FPRAS) for the problem of counting the number of linear extensions [301 121 j . 
where the algorithm finds, with probability 1 — 5, a (1 + e)-approximation of the number of the linear 
extensions in time poly(n, 1/e, log(l/5)). Now given a poset (S, >) and two elements a,b £ S, we can 
apply this algorithm to posets (5, >), getting an output m, and apply the algorithm on (S, >'), getting 
an output n2, where >' is obtained from > by incorporating an extra relation (a > b). Then Pr(a y b) 
can be approximated by n^jnx (with the precision yrf )• It is easily seen from the definition of h(a) and 
that of Pr(6 >- a) that 

h(a) = ^Pr(6^ a). 

By setting e = ^ to approximate the value of each Pr(6 y a) and using them to compute the value 
of h(a), we can derive in polynomial time a value h'{a) such that 1 — ^ < -jj^y < 1 + 2n with high 
probability. Since h(a) < n, we have 

\h'{a)-h{a)\ < ^ < 0.5. 

2n 

Using h'(a) to sort all elements in S in order (0^,0^, . . . ,afc n )> we have by the above inequality that 
/i'(afcj < h'{akj) for any i < j with arbitrarily high probability. This implies h(ai ti ) — h^a^.) < 1, and 
thus, Pr(afc j >- a&J < yy. Therefore, this is a good order for the current poset (S, >). The whole process 
can be done in polynomial time, which completes the proof of the upper bound side. 
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For the lower bound side, it was also shown in [12] that for any poset (S, >), there exist two elements 
a, b G S such that Pr(a >- b) > y^ and Pr(6 >- a) > yy. Thus, we construct the verification oracle as 
follows. At any step, when the previously returned information forms a poset (S, >), no matter what 
the current proposed order is, the oracle always returns such (a, b) (or (6, a), depending on their relative 
position in the proposed order) as a violation. Then after this trial, at least yy fraction of the possible 
linear extensions still remains. Therefore, we have R(Sorting u ) > log 11 / 3 rt! = f2(nlogn). □ 

Having the upper bound result for Sorting u , we can consider the preference of each individual as a 
sorting problem and solve these 2n Sorting u problems together, which gives us the desired upper bound 
for the StableMatchingu problem. 

Proof of Theorem^ At each step, since our collected information gives a poset (W, > m ) for each man m 
and a poset (M, >„) for each woman. We can use (part of) the above algorithm for Sorting u to compute in 
polynomial time a good order >~ m for each man m and a good order y w for each woman w with respect to 
their current posets. Then we take these good orders as their preferences and compute a stable matching 
H using Gale-Shapley's algorithm. Then we make a query \i to the verification oracle for StableMatching u . 
If it is not a stable matching, then V returns a blocking pair (m, w) satisfying w >~ m A*( m ) an d m y w n(w). 
Notice that at least one of these two new relations conflicts with the assumed preferences {V m , y w }, which 
means that it can serve a valid verification oracle for Sorting u . Since (i) there are totally n man and n 
woman, (ii) at each step at least one man or woman gets a new pair of elements to update their posets, 
and (iii) by Lemma [6] we know that each poset will be updated at most 0{n log n) times, we know that 
this stable matching algorithm calls the verification oracle 2n • 0{n log n) = 0(n 2 logn) times. Finally, 
since all computation between trials can be done in polynomial time, the time complexity of the algorithm 
is in polynomial. □ 

Note that the same results for deterministic algorithms hold; that is, there is an exponential-time 
deterministic algorithm using 0(n log n) trials for Sorting u (and thus another algorithm using 0(n 2 log n) 
trials for StableMatchingu), namely, D(Sorting u ) = O(nlogn) and D (StableMatchingu) = 0(n 2 log n). The 
reason is simple: we can compute the average height h(a) for every a by enumerating all linear extensions of 
the current partial order. See Section [9] for more discussions on polynomial time deterministic algorithms. 

Note that our algorithm for StableMatchingu essentially runs 2n Sorting u instances to learn the entire 
unknown input of the preference lists, and analysis of the trial cost simply involves adding the trials made 
on these instances. Although the Q(nlogn) lower bound for Sorting u implies a limit to this approach, 
there seems to be considerable room for improvement. It may be unnecessary to learn all of the input 
lists to find a solution, and there may be more sophisticated ways to solve 2n instances of Sortingu to 
beat the naive upper bound by addition. However, the following theorem gives an almost matching lower 
bound for StableMatchingu. 

Theorem 7. Any randomized algorithm for StableMatchingu needs at least Q(n 2 ) trials even with un- 
bounded computational power. 

Proof. For each man m, we create a directed graph G m with vertex set W and edge set initially empty; 
similarly create a directed graph G w for each woman w. For each proposed matching //, after a blocking 
pair (m, w) is returned by the verification oracle, we know that m prefers w to yu(m) and w prefers m 
to fj,(w). We update the graphs G w and G m as follows. If there is no directed path from fj,(m) to w, we 
add an edge (/J,(m),w) in the graph G m . Similarly, if there is no directed path from fJ,(w) to m, we add 
an edge (/j,(w),m) in G w . Since we have made k queries to verification oracle, there are at most k edges 
altogether in all graphs G m and at most k edges in all graphs G w . Note that these 2n graphs are all the 
information an algorithm gets from the trials and answers. 
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Our proof is by probabilistic method. Suppose we have already made k queries.We pick a pair (m, w) 
uniformly at random in all possible n 2 pairs, and will show the following property for any matching a: If 
k < {n 2 — n)/2, then with a strictly positive probability, (m,w) is a blocking pair for a on some input 
instance consistent with the queried information so far. Therefore, k queries to the verification oracle 
are not sufficient to guarantee to find a stable matching, as for any candidate output u, there are still 
instances with blocking pairs for it. 

The analysis of the probability goes as follows. First, with probability 1 — 1/n, the pair is not in the 
current matching n. Second, we claim that with probability at least 1 — k/n 2 , m could prefer w to u(m). 
Here "could" means that there is an input instance consistent with the previous trials and answers but in 
the input m prefer w to n(m). Indeed, this could not happen only if the known preferences of m already 
imply that w is less preferred than /i(m); namely there is a path from w to u(m) in the graph G m . But 
there are not many preferences known — on average, only k/n preferences known for m. Formally, for 
a randomly chosen w, the event that "u> is known to be less preferred than u(m) by to" happens with 
probability 

— • (the number of nodes that can reach fi(m) in G m ) < — ■ (the number of edges in G m ) 
n n 

So averaging over all men gives that 

Pr \m prefers w to u(m)] > 1 • — • (the total number of edges in all men's graphs) 

n n 

> 1 -k/n 2 . 

Third, similar analysis shows that with probability at least 1 — k/n 2 , w could prefer m to her current 
assignment /J,(w). Putting all these together, with probability at least 1 — ^ — ^1, the pair (m,w) can be 
a blocking pair. The probability is strictly positive if k < (n 2 — n)/2, meaning the existence of a blocking 
pair. Therefore k needs to be larger than (n 2 — n)/2. □ 

A final comment is that in the traditional stable matching problem, where the preferences are known, 
there is a tight lower bound ft(n 2 ) for computing a stable matching [58] . However, this bound refers 
to the computational time complexity in a completely different meaning from our trial complexity lower 
bound. 



3 SAT 

Given a CNF formula eft with n variables and m clauses, the SAT search problem is to find a satisfying 
assignment to <f) if one exists, or to return tl <f> is unsatisfiable." In the unknown-input version SAT U , 
the formula cj) is unknown, and each time that a proposed solution x is not a satisfying assignment, the 
verification oracle returns an index i such that the z-th clause of <p evaluates to FALSE on x. 

First, we clarify that the computation oracle for SAT is defined as follows. On a query (j) which is 
a CNF formula, SAT returns a satisfying assignment x to 4>, or reports that such x does not exist. So 
this SAT oracle solves the search problem instead of the decision problem. This is for the fair comparison 
since the target SAT U is also a search problem. Also note that the search and the decision problems for 
SAT are roughly the same due to the standard self-reducibility. 

Our algorithm solving the SAT U problem is as follows. 
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Algorithm 1 Alg-SAT 



Unknown input: A formula <fi of n variables and m clauses. 

Let Li = L 2 = ■ ■ ■ = L m = {xi,Xi, . . . ,x n ,x n }. 
loop 

Let ^ = A£i(VW). 
Query the computation oracle SAT on <fi' . 
if the computation oracle says that </)' is not satisfiable, then 

return <f> is unsatisfiable (and terminate the program), 
else 

Suppose the computation oracle gives a satisfying assignment x of i 
Ask the assignment x to the verification oracle V. 
if V confirms that 4>(x) = 1 then 

return x (and terminate the program), 
else 

Suppose V returns an index i. 
Let Li ^{feL,: l{x) = 0} 
(i.e., those literals in Li evaluating FALSE on x). 
end if 
end if 
end loop 



The idea of the algorithm uses a standard candidate elimination approach [33] , which has been used 
extensively in learning theory (e.g., PAC learning for CNF formulas [71]). The algorithm initially includes 
all literals, i.e., x\ V x\ V • • • V x n V x n , in each clause. It proceeds by employing the SAT computation 
oracle to propose an assignment x consistent with the current knowledge of the clauses. If a clause's 
index is returned by the verification oracle upon a trial, then we know that Xi cannot be in the clause if 
Xi = 1 and that Xi cannot be in the clause if X{ = in the assignment of the trial. We therefore remove 
the literals from the clause, and continue the process until either a satisfying assignment is found or the 
computation oracle returns the result that no satisfying assignment exists. 

Theorem 8. Alg-SAT solves the SAT U problem in polynomial time using 0(mn) trials, where n and m 
are the numbers of variables and clauses, respectively. 

Proof. Correctness. The set Li maintains a collection of possible literals for the i-th clause in the unknown 
formula <j). Note that if (f> is satisfiable, so is aV, at any step of the algorithm. Indeed, at the beginning 
all literals are included in each clauses and <f>' is trivially satisfiable. Each time Lj is updated, the literals 
that are removed from Li are exactly those £ with £{x) = 1. But the literals in the actual i-th clause Cj 
of 4> all evaluate to 0, because Ci(x) = y^a^{ x ) = 0- Thus, all the literals in d are kept when Li is 
updated. Therefore a satisfying assignment x to 4> also satisfies <p' . 

Also note that if <f>'(x) = 1, then there exists at least one £ £ Li such that £{x) = 1. So the size \Li\ 
decreases by at least 1 each time Lj is updated. Since (f>' is always satisfiable and Yl% decreases by 
at least 1 in each iteration, the algorithm finally stops and outputs an x with <j){x) = 1. On the other 
hand, if <f> is unsatisfiable, then (j)(x) never evaluates to 1, thus finally the algorithm outputs that 4> 1S 
unsatisfiable. 

Complexity. Since initially \L\\ = ••• = \L m \ = In, the algorithm runs in at most 2nm rounds. In 
each round finding a satisfying assignment of <f>' takes one query to the computation oracle, so the trial 
complexity are 0(nm). The time complexity of the algorithm is poly(n) as all computations between 
queries can be done in polynomial time. □ 
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Our upper bound result implies that not knowing the input formula does not add much extra com- 
plexity (up to a polynomial) to finding a satisfying assignment. For a related problem, 2SAT, in which 
every clause contains at most 2 literals, which can be solved in polynomial time, we can show that solving 
2SAT u in polynomial time implies P — NpJ^I Therefore, it is indeed the power of the computation oracle 
SAT that yields our efficient algorithm for S AT U . Recall that the focus of our study is not to discover the 
complexity of solving SAT U itself, but rather, is to understand the relative complexity of solving SAT U 
compared with that of solving SAT. 

Note that our algorithm directly shrinks the space of possible inputs (i.e., formulas), instead of the 
space of possible solutions (i.e., assignments). (While some variables may have their values fixed along 
the process of the algorithm, this may not necessarily be the case and is surely not the reason why 
our algorithm works within 0(mn) queries.) When a satisfying assignment is found by the algorithm, 
however, we may still do not know the exact input formula. This echoes the medical treatment application 
mentioned in Introduction, where finding a solution is much more urgent than learning the unknown input, 
and it is indeed often possible to find an effective diagnostic reagent long before completely knowing the 
virus. 

In the complexity language, we ask whether it is computationally much harder to find out the hidden 
CNF formula (even with the help of the computation oracle SAT) than finding a solution. Learning the 
exact formula is clearly impossible since, for example, if there is a clause Xi V Xi, then we can never know 
this clause. Even if we relax the requirement by clustering the formulas with the same set of satisfying 
assignments, and allowing to output any formula within the cluster of the hidden input formula, it is 
still exponentially harder than finding a solution. This separates ours from the standard concept learning 
model. 

Proposition 9. Any randomized algorithm with e-error, e < 1/2, needs 2 n trials to output a formula <j)' 
with the same set of satisfying assignments as the hidden input formula <f>. 

Proof. We will give a collection of 2 n + 1 formulas as follows. For each y G {0,1}™, define (j) y to be a 
formula of only one clause, which has n literals. The i-th literal is X{ if y\ = 1, and is Xi if yi = 0. 
This makes <f> y to be satisfied by all assignments of x except for x = y. The last formula can be any 
tautology. We will confine the hidden input formula to within this selection | y G {0, l} n } U {4>q}- 
Note that all these formulas have different sets of satisfying assignments; thus, outputting a formula cp' , 
with the same set of satisfying assignments as 4>, requires to identify the input formula from this selection. 

Now for any randomized algorithm that tries to output a formula <ft', and any first k queries x 1 , x k it 
makes, we, as an adversarial oracle, always answer Yes. The only information that the algorithm obtains 
at this point is that the hidden input formula is not 4> x i, (p x k. If the algorithm outputs a formula, then 
the success probability would be 1/(2™ + 1 — k). Thus the algorithm cannot pin down <f> with an error 
probability smaller than 1/2 until asking all potential solutions in {0, l} n . □ 

We also have a lower bound on the randomized trial complexity of SAT U , which matches the upper 
bound at least when m = £l(n 2 ). 

Theorem 10. Ifm = f2(n 2 ), any randomized algorithm for the SAT U problem needs at least Q(mn) trials, 
even with unbounded computational power. If m = o(n 2 ), the lower bound is Sl(m 3 / 2 ). 

The proof of the lower bound is combinatorially involved, in which we construct instances such that 
only one candidate literal can be eliminated in the foregoing process. This is enforced with the help of 
certain clauses that confine all satisfying assignments to a very special form. Further, we remark that the 

6 The idea of the reduction is similar to the one described in the next section for group isomorphism. 
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proof can be easily adapted to show the same lower bound for the decision problem, namely to decide 
whether a formula (with unknown clauses) is satisfiable. 

Proof. We will first show the lower bound of 17(n 3 ) for the special case when m = 0(n 2 ). Then we will 
consider the cases when m = uj(n 2 ) and m = o{n 2 ). 

Let m* = ( n 2 3 ) + tj- + 3. We will construct a family of CNF formulas with n variables and m clauses, 
where m* < m < 0(n 2 ). Without loss of generality, we assume that 3 divides n. Divide [n] into three 
equal blocks: B 1 = {l, 2, . . . , 2 }, B 2 = {§ + 1, f + 2, . . . , and B 3 = {f + 1, ^ + 2, . . . , n}. We, 
as an adversary constructing the verification oracle, maintain a set T of triples (11,1-2,13), with T initially 
containing (ii, i 2 , 13) with all i\ G Bi, i 2 G -B2 and 23 G -B3. Each triple i 2 , 13) represents an assignment, 
denoted by x(i±, i 2 , is), where Xi = 1 if and only if i G i 2 , 13}. We will show that some of the formulas 
in the constructed family have a unique satisfying assignment of the form x(i\,i 2 ,iz), which can only be 
found by at least (^) 3 queries for any randomized algorithm and a carefully designed verification oracle. 

The hidden formula <p has 0(n 2 ) clauses, divided into two parts, each with 0(n 2 ) clauses. The first 
part ensures that any satisfying assignment of (j) needs to have exactly one variable X{ = 1 in the last 
block. This can be done by 0(n 2 ) clauses because we use one clause Vj g B 3 Xi to enforce that there is at 
least one X\ = 1 in that block, and then use Xi V Xj to enforce that at most one of x,- L and Xj is assigned 
to be 1. Thus, this part of formula 

(Vj eBl Xj) f\ {VieB 2 x-i) /\ (Vie^Xi) f\ (xiVxj) 

i,jeB 3 :i^j 

ensures that a satisfying assignment has at least one X{ = 1 in each of the first two blocks, and exactly 
one X{ = 1 in the last block. This part has ( ra ^ 3 ) + 3 = 9(n 2 ) clauses. 

2 

The second part of the formula consists of ^- clauses, indexed by the pairs i 2 ) for each i\ 6 B\ and 
i 2 G B 2 . The clause associated with (ii,i 2 ) is either (x^ V aij 2 ) or (x^ V x~i 2 V Xi 3 ) for some i% G -B3. For 
an arbitrary randomized algorithm, on each query x, if x does not satisfy the first part of formula, then 
we return the corresponding clause in that part. (This first part can be even revealed to the algorithm 
for free.) Now assume that x satisfies the first part and it has three positions ii,i 2 ,is being 1, one in each 
block. (If there are multiple l's in the first two blocks, let i\ and i 2 denote the positions of the first l's in 
the corresponding blocks.) Let the verification oracle return the clause with index (ii,i 2 ); note that this 
implies that the clause cannot be of the form (x^ V Xj 2 V Xj 3 ). We then update the candidate set T by 
removing one element (ii,i 2 ,i3) from it. Note that this is also all the information the algorithm obtains 
from this query, that is, for any (i'i,i 2 ,i' 3 ) G T, (z'i,^,^) / (^1,^2^3)5 ^{i'^i'^i'^) can still be a possible 
satisfying assignment. 

This process continues; we claim that as long as \T\ > 2, namely it contains at least two distinct triples 
(h ^2 ^3) and (ii,i 2 ,i's), then the formula can be either with a unique satisfying assignment x(ii,i 2 ,is) 
or with a unique satisfying assignment x(ii,i' 2 ,i' 3 ), thus the algorithm does not know what to output 
yet. Indeed, all previous queries by the algorithm cannot distinguish the following two possibilities: The 
second part of the formula can be either 

4>i = /\ (% V x h ) f\ (x h V x i2 V x ki ) 
Cn, .72)^(11 ,12) 

or 

<j) 2 = f\ (% V x j2 ) f\ (x^ V x i>2 V a:^ ) 
Cnj2)^(ii,i 2 ) 

where jk is in block B^. 
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We claim that both formulas are satisfiable, and actually each has a unique satisfying assignment, 
namely x(i\, $2,^3) and x(i' l5 i' 2 , i' 3 ), respectively. Let us consider fa as an example. First, it is easy to 
see that x(i,i,i2,i$) does satisfy fa. Second, the assignment x(i\,i2,iz) is the only satisfying assignment. 
Suppose x satisfies fa, then to satisfy (V ieBl Xi) /\(Vi e B 2 Xi) A(i 1 ,i 2 )^(i 1 ,i 2 )(%i v %)> we nave x u = x *2 = 1 
and = for i G 5i U B2 - Otherwise, if Xj ± = 1 for any ji / i\ in Si, then Xj 2 = for all 

32 £ B2, violating Vj e ,B 2 Xj. Thus, xj 1 = for all j\ 7^ &i in J3i; the clause (VjgSjXj) then forces Xj x = 1. 
Similarly we can show that Z2 is the only position in B2 with assignment 1. Now to satisfy the last clause 
in fa, Xi s must be 1, and the first part of formula guarantees that i% is the only position i in B3 with 
Xi = 1. Thus, x(ii,Z2,«3) is the only satisfying assignment. 

Since initially \T\ = (n/3) 3 and each query decreases |T| by 1, we know that the algorithm needs at 
least (n/3) 3 = f2(n 3 ) queries in the worst case. 

Now consider the case that m = ui(n 2 ). Suppose c > 2 is the minimum integer that m < (^) c - Divide 
the variables into c + 1 blocks, with the first c blocks of size k x = (%)V C < £, and the last block of size 
&2 = n — ck\. Note that k\c < § and thus ki > By a similar setting of the previous formulas, we can 
use (^ 2 ) + 1 clauses to ensure that all the satisfying assignments have exactly one Xj = 1 in the last block, 
and c clauses to ensure that there is at least one x% = 1 in each of the first c blocks. We also use k\ clauses 
to hide a unique tuple [i\, . . . ,i c +i), with each ii in block I, such that the assignment x with x« = 1 if 
and only if i = in, for I £ [c + 1], is the unique satisfying assignment. Then we use k\ + ( fc 2 2 ) + 1 + c < m 
clauses to hide the satisfying assignment, to find which needs k\ k2 > y • § = 0,(mn) queries. 

Finally, for the case of m < m* , we only use @(^/m) variables. The problem is then reduced to the 
first case, which gives a lower bound of Vl(m^fm) = S7(m 3 / 2 ). □ 

4 Group Isomorphism 

Given two groups, G and G', of the same size, the group isomorphism (Grouplso) problem is to find an 
isomorphism between G and G 1 or to report that U G % G'" . More precisely, given two groups, G and G' , 
by their multiplication tables, T nxn and T^ Xn , our task is to output a bijection -k : G — > G' such that 

7r(a o b) = vr(a) o' ir(b) (2) 

for all a, b G G (where o and o' are the multiplications of G and G' , respectively), or to report that 
"G % G"' . 

Whether a polynomial time algorithm exists for the general Grouplso problem is a long-standing open 
question. Compared with another well-known problem, Graph Isomorphism, however, Grouplso has more 
group structures for potential use, and indeed, Grouplso can be solved in polynomial time if the given 
groups are Abelian, and (the decision version of) Grouplso is in NP n co-NP (under certain complexity 
assumptions) if the given groups are solvable [8]. 

The problem is by nature a constraint satisfaction problem, searching for a bijection tt that satisfies 
the n 2 constraints Eq.([2]). In the unknown- input model, we can consider the case of both groups being 
unknown and that of exactly one group, say, G, being unknown. In either case, we can propose bijections 
tt to the verification oracle V. If tt is not an isomorphism, then V gives a pair (a, b) with the foregoing 
equality violated. Our upper bound result in this section applies to the general case in which both groups 
are unknown, and our lower bound result applies even to the restricted case in which one group is known. 

A very natural attempt to solve Grouplso u is to keep proposing bijections tt that are consistent with 
our current knowledge of the restrictions of a valid bijection. More precisely, whenever V returns a pair 
of elements (a, b) on a proposed tt, it adds the restriction that we cannot simultaneously map the three 
elements (a,b,aob) to (7r(a), 7r(6), vr(a) o' 7r(6)). Thus, there are no more than (9(n 6 ) forbidden rules. Note 
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that finding a bijection that avoids a list of forbidden pairs of triples is easy with an NP computation 
oracle. Thus, Grouplso u can be solved using SAT as the computation oracle in polynomial time and via 
0(n 6 ) trials. 

An immediate question that arises from this claim is the following. Does it hold with only a computa- 
tion oracle Grouplso instead of SAT? (After all, only comparison with Grouplso reveals the extra difficulty 
arising from the unknown input on the problem.) This seems quite conceivable that this is the case, 
as group theory by definition handles triples in the form (7r(a), 7r(6), 7r(o) o' 7r(6)), and we have not yet 
exploited the group structures in the given tables. Surprisingly, this intuition turns out to be misleading, 
as shown by the following hardness result, which stands even if one group G' is known to us and is a very 
simple group Z p for a prime p. Denote the known-input version of this problem by Grouplso(-, Z p ). Note 
that because it is solvable in polynomial time, the computation oracle is not needed (modulo a polynomial 
factor in runtime) in the unknown-input model. 

Theorem 11. // Grouplso(-, Z p ) u can be solved in polynomial time, i.e., Grouplso(-, Z p ) u G P v , then 
P = NP. More specifically, if Grouplso(-, Z p ) u can be solved in time t(p), then HamiltonianCycle can be 

solved in time 0(t(p) ■ p), where p is the order of the given group 7L V . 

Idea of the proof. The hardness result is shown by a reduction that is not very standard. Given a graph 
H with p vertices, we employ an algorithm A for Grouplso(-, Z p ) u to find a Hamiltonian cycle in H in 
the following way. Assuming the existence of a Hamiltonian cycle C (it can be seen that the primality 
of the size of the graph and the assumption of the existence of one Hamiltonian cycle do not alter the 
hardness of the Hamiltonian cycle problem), define a group T via C as follows. Let (60, b±, . . . b p -i, bo) 
be a Hamiltonian cycle C in graph H. We can fix a vertex a and assume that b\ = a, which is always 
achievable by a cyclic shift in the labels in the Hamiltonian cycle if necessary. For simplicity, we use 
the vertices of H to denote the elements of group T. Now, for any bi and bj in group T, define their 
multiplication by bi o bj = b i+ j mo( j p . It is easy to see that T is a cyclic group with p elements (where b\ 
is a generator of the group). 

The main idea of the reduction is to run algorithm A on input (T, Z p ), and translate the output of 
A, which is an isomorphism from T to Z p , to a Hamiltonian cycle in the given graph H. However, one 
problem immediately arises: Because the reduction algorithm has only polynomial time, and it cannot 
find such a Hamiltonian cycle, thus cannot construct the multiplication table T. 

To get around this issue, we employ the crucial fact that A does not know its first input — all of 
A's information about T comes from interactions with its verification oracle V. Thus, it is sufficient to 
construct a V that answers A's trials. However, doing so again requires the information on T, which is 
exactly what we do not have. Here, the idea is to efficiently construct a simulator V to take the place 
of V. Given the shortage of running time, it is inevitable that we lose something in our simulator V', 
and, in our final construction it turns out to be the correctness, which is the seemingly the most critical 
component. In other words, V cannot answer all of *4's questions correctly. What makes it still qualified 
for our purpose is the following key property. On any ir proposed by A, V 

1. either provides a correct response to 7r, or 

2. finds a Hamiltonian cycle in H. 

This property means that the first time V gives a wrong answer to A, it has just found a Hamiltonian 
cycle in H. (A's output is admittedly now out of control now, but we no longer care about the correctness 
of A; we have used part of „4's code to solve our HamiltonianCycle problem.) □ 
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Formal Proof of Theorem\ll\ In the HamiltonianCycle problem, we are given a graph G with p vertices and 
are asked if it has at least one Hamiltonian cyclqj- Suppose that there exists an algorithm A that solves 
the Grouplso(-, Z p ) u problem in time t(p). We now construct an algorithm B for the following variation 
of the HamiltonianCycle problem: Given a graph G with p vertices and the condition that it contains at 
least one Hamiltonian cycle, find a Hamiltonian cycle in G; call the problem PromisedHamiltonianCycle. 

Now we are given a graph G with p nodes, we label the nodes in G as a±, 02, ■ ■ ■ , a p in an arbitrary 
way. We will construct an algorithm B that uses algorithm A to find a Hamiltonian cycle in G, assuming 
one exists. 

First we describe a cyclic group lH with elements ai, . . . , a p . Let (bo, b\, . . . b p -\) be a Hamiltonian 
cycle in graph G. If there is more than one Hamiltonian cycle, pick an arbitrary one. We can further 
impose that b\ = a\, which is always achievable by a cyclic shift if necessary, since a Hamiltonian cycle 
contains every vertex. Now for any b{ and bj in group T, define their multiplication by b{ o bj = bi+j mo d p 
(all additions hereafter are module over p). It is easy to check that T is a cyclic group with p elements. 

The algorithm B basically runs the algorithm A on input (T, Z p ). If finally A outputs a correct 
bijection ir mapping T to Z p , then we can identify all b{S and thus find a Hamiltonian cycle. However, 
we do not know how to provide a valid verification oracle, because in polynomial time we cannot find 
(60, b%, —fbp) and define the multiplication table of T as above. The idea here is to construct a simulator 
V' of the verification oracle in such a way that V' 

1. either provides correct responses to „4's trials, or 

2. finds a Hamiltonian cycle for B. 

The V and the algorithm B are given below. 

Algorithm 2 Simulator V given (G, 7r) 
Input: Graph G, and bijection ir : T — > Z p 

1: Let x = vr(ai). 
2: if x = then 
3: return (ai,ai). 
4: else 

5: ii^ielps.t. (Tr-^^^-^^ + l)^)) £ E(G) then 
6: return (ir~ 1 (ix), a\) for the first such i. 
7: else 

8: return Yes. 
9: end if 
10: end if 



Several explanations of the algorithms are in order. First, note that in the course of the algorithm, B 
defines T and runs A on input (T, Z p ). However, as we have mentioned, B actually does not know how to 
find a Hamiltonian cycle in polynomial time and to define T. Here we use the key property that A does 

7 The primality of the graph size does not change the hardness of this problem. For a given graph with n vertices for a 
general number n, one can first find a prime in [n, 2n] (which takes time n ■ poly (log n)) and then for an edge (u, v) in the 
given graph G, add a path from u to v with (p — n) extra vertices to form a new graph G' . It is easy to see that G' has a 
Hamiltonian cycle if and only if G has a Hamiltonian cycle using the edge (u,v). Fix an arbitrary u, try all neighbors v in 
G using the algorithm for the new instances and verify the solutions, we will know that whether G has a Hamiltonian cycle. 

8 Precisely, T is defined according to G and should be written as T(G). As all our discussions are with respect to the given 
graph G, for simplicity we will use T in the proof. 
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Algorithm 3 Algorithm B for the PromisedHamiltonianCycle problem 
Input: Graph G with at least one Hamiltonian cycle 

Suppose there is a Hamiltonian cycle (60, &i, b p -\); circularly shift the cycle to make b\ = a\. 
Define a group T with the multiplication table given by T(bi, bj) = bi + j mo d p- 
Run A on input (T, Z p ), during which: 
if A makes a query tt to the verification oracle V then 

run V'(G, tt) to simulate V to give either Yes or a pair (dj, aj) as an answer, 
if the answer is Yes then 
x = 7r(ai). 

return a Hamiltonian cycle found: 



-*(()), TT- 1 ^), 7l-\2 X ), TT^dp - l)x)). 



end if 
end if 

if A outputs a then 

return a Hamiltonian cycle found: 
{a- 1 (0\a- 1 (a(a 1 )),a- 1 (2a(a 1 )),...,a- 1 ((p-lMa 1 ))). 
13: end if 



not know its input: by saying ll B runs A", we mean to let B run A's code between trials; whenever A 
makes a trial tt, B uses V' to simulate the true verification oracle V to give an answer. 

This immediately raises the second issue: Our designed V is not a valid verification oracle for the 
Grouplso(-, Z p ) u problem, since it may return Yes for some wrong bijection. (That is, even if a bijection 
7T does not really map T to Z p , our oracle V may say Yes.) But what we can guarantee are the following 
two properties of V'. The first is roughly the soundness for the algorithm A. 

Claim 1. // V' returns a violation (ai,aj) to a proposed tt, it is indeed a violation. 
Proof. If V returns (a±,ai) in the outer if statement, then it is a violation because, as tt is a bijection, 

7r(ai o T ai) = 7r(6 2 ) 

but 

vr(ai) + vr(ai) = + = = vr(ai) = tt(&i) / tt(6 2 ). 

(Here we use o T to emphasize that it is a multiplication of group T). 

The other possibility is that V' returns (it" 1 {ix) , a\): Suppose it is not a violation, then 

(tt^ 1 (ix) , ai) is not a violation (3) 

=^ 7r(7r _1 (ix) o T a\) = Ti(ir~ l (ix)) + 7r(ai) (4) 

=4> 7r(-7r~ 1 (ix) o T ai) = ix + x ( 7T ( a i) = x ) (5) 

=4> ir~ 1 (ix) o T a\ = vr~ 1 ((i + l)x) (taking 7T" 1 ) (6) 

=^ (tt -1 (ix) , tv -1 ((i + l)x)) G E (7) 

where the last line is because o T b\ is defined as going to the next vertex along the Hamiltonian cycle 
(6 ,6i,...,6 p -i). □ 

The second property is roughly the soundness for B; it relies on the fact that all non-zero elements of 
Z p can generate the whole Z p . 
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Claim 2. If V' returns Yes to a proposed it , the vertices (7r _1 (0), 7t _1 (:e), 7r (2a;), 7r~ 1 ((p — l)x)) in 
that order, as later outputted by B, indeed form a Hamiltonian cycle of the graph G, regardless of whether 
7r is a correct bijection. 

Proof. When V returns Yes, it comes to the else branches of both the outer and inner if-then-else 
statements. The inner statement implies that all edges (ir~ 1 (ix),7r~~ 1 ((i + l)x)) exist. The outer statement 
implies that x 7^ 0, and therefore {0, x, 2x, (p — l)x} = {0, 1, ... } p— 1} since each non-zero is a generator 
of 7L V for prime p. Combining the two gives a claimed Hamiltonian cycle. □ 

By Claim [H we know that before V returns Yes, all answers of V" to ,4's trials are valid. And Claim [2] 
guarantees that once V returns Yes, B already finds a Hamiltonian cycle (and terminates the program). 
Note that when V' returns Yes, it may not be a correct response to A, but now we do not care the 
correctness or even the completeness of the execution of A any more, because we have already used A's 
code to serve our purpose of finding a Hamiltonian cycle for G. 

The analysis so far shows that the algorithm B correctly outputs a Hamiltonian cycle as long as V 
answers Yes. To finish the proof, we need to address the case that A halts before V answers Yes. First, 
since the graph G does have a Hamiltonian cycle by promise, the group T as defined does exist (despite 
the fact that B could not really find it) and it is indeed isomorphic to Z p . Hence, a correct algorithm A 
cannot output No. 

Now the only left case is that A may somehow infer, from the violations returned by V , a valid bijection 
a that maps T to Z p before V returns Yes. In such a case, we can actually identify each bi = a~ 1 (ia(ai)): 
First, 60 = 7r_1 (0) since that is the only element which does not change by multiplying itself. Then, for 
all i > 1, we have 

a(bi) = a( bi o . . . o h) (def of o in T) (8) 

i bi's 

= o~(b\) + ... + o~(b\) (a is a isomorphism) (9) 

V V ' 

i times 

= i . a(bi) = i ■ a( ai ) (10) 

Thus, (a- 1 (0),a- 1 (a(a 1 )),a- 1 (2a(a 1 )),...,a- 1 ((p-l)a(a 1 ))) 

= (bo, b±, ... , 6p-i), as outputted by algorithm B, is a Hamiltonian cycle. 

Finally, the runtime of algorithm B is easily upper bounded by that of A times that of V". So it takes 
B at most 0(t(p) ■ p) time to solve the PromisedHamiltonianCycle problem. Now given a HamiltonianCycle 
problem instance with p nodes, we can run algorithm B on this instance and incorporate its polynomial 
time bound as a time limit. After the time limit, we check the output of the algorithm B, and accept if 
it is indeed a valid Hamiltonian cycle. If algorithm B outputs a wrong Hamiltonian cycle or it fails to 
output one, we reject it. Thus in this way the HamiltonianCycle problem can be solved in 0(t(p) ■ p) time 
too. This completes the proof. □ 

A few remarks about the above proof are in order. 

1. The polynomial-time algorithm B cannot find a certificate of an NP statement but can create a 
simulator for its own purpose. This phenomenon is reminiscent of the simulator paradigm in some 
cryptographic notions such as zero-knowledge proofs. However, differences are also clear, because 
simulators in zero-knowledge proofs are used to show that the interaction to the prover is in some 
sense "useless" , while the simulator in our proof is actually useful for forcing A to leak information 
of a witness (in our case, a Hamiltonian cycle). 
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2. One can generalize the theorem by allowing the algorithm A to also invoke a computation oracle C. 
Then our algorithm B can invoke the same oracle C during simulating A, and thus the conclusion 
becomes that "if Grouplso(-, Z p ) u can be solved in time t(n) with computation oracle C and veri- 
fication oracle V, then HamiltonianCycle can be solved in time 0(t(n)n 2 ) with computation oracle 
C". This implies that Grouplso(-, Z p ) u is not likely to be solved in polynomial time by the help of a 
computation oracle weaker than NP. 

5 Graph Isomorphism 

In the graph isomorphism (Graphlso) search problem, we are given two undirected graphs G± and G2, and 
we are asked to find a bijection ir : V^(Gi) — > V{G2) s.t. G V(G\), 

G E{G X ) & G E(G 2 ), (11) 

if such a permutation exists, and to output "Gi 3= GV' otherwise. The graph isomorphism is a well-known 
NP problem whose complexity is still open. 

In our unknown-input version, Graphlso u , we can consider both the case that the two graphs are 
unknown, and the case that exactly one graph, say G\, is unknown. The latter case corresponds to the 
situations where we want to compare an unknown object (such as a new chemical compound) to a known 
one (such known chemical compound). 

In either setting, we can propose a bijection ir : V{G\) — > V(G2). If it is indeed an isomorphism, the 
verification oracle returns Yes; otherwise, it returns a pair i,j G V{G\) violating the above equivalence 
Eq.(HI])@ Our upper bound result in this section applies to the model when both graphs are unknown, 
and our lower bound result applies to the model when one graph is known. Therefore, both of our upper 
and lower bound results are at the stronger sense. 

A natural try for an algorithm is, as in the algorithms for StableMatching and SAT, to keep proposing 
bijections ir that are consistent with the current knowledge of the edge information of the two graphs. 
More precisely, each returned violation implies that a homomorphism, if one exists, should not 

simultaneously map i to ir(i) and map j to 7r(j) (or i to ir(j) and j to ir(i)). Actually we can do 
better: Consider a bipartite graph H with (™) nodes at each side, where the left and right hand side 
nodes are indexed by all pairs of different vertices (i, j) in G± and G*2, respectively. Starting from empty, 
H is updated as follows. Each time we propose a bijection ir and V returns a pair (i,j), we add an 
edge ((?,j), (vr(i) , vr(j'))) in H. Then an efficient algorithm tries to propose a bijection ir s.t. and 
(ir(i),ir(j))) are not in the same connected component in the current H, so that any newly returned 
gives a new piece of information. More precisely, each added edge in H decreases the number of connected 
components by 1. Since initially all 2Q) nodes in H are isolated and finally the nodes form at least one 
components, the algorithm stops after at most 2Q) — 1 trials. 

The above analysis gives a trial-efficient algorithm to solve Graphlso u . When it comes to the time 
complexity, we need to address the question of how to find a ir to avoid a collection of forbidden pairs. 
This can surely be done if we are given an NP oracle since checking a bijection avoiding a list of forbidden 
pairs is easy. This leads to the following proposition. 

Proposition 12. Graphlso u can be solved using SAT as the computation oracle in polynomial time and 
by 0(n 2 ) trials. 

9 Note that a return of V only implies that exactly one edge (i, j) £ E(Gi) or (7r(i), £ E{G2) exists, but does not tell 

which one. One may consider to define a stronger V revealing this further piece of information, but we will show that this 
distinction does not matter: Our algorithm works with the weaker V, and our hardness result holds even for the stronger V. 
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Of course, as in SAT M 6 P ' , one naturally desires an algorithm using only Graphlso as the compu- 
tation oracle for Graphlso u . It looks quite achievable: After all, graphs is by nature a collection of binary 
relations, and the well-developed graph theory is a large source of tools. Indeed, it is not hard to show 
by a simple probabilistic argument that one can propose a tt to avoid 0(n) existing forbidden pairs, so 
it is "merely" the matter of whether the process can continue to handle more forbidden pairs. However, 
these intuitions turn out to be wrong, as refuted by the following theorem about the necessity of the SAT 
computation oracle. 

Theorem 13. //Graphlso u can be solved in time t(n) with computation oracle A and verification oracle 
V, then Clique can be solved in time 0{t{n)n 2 ) with oracle A. 

Proof. We prove the claim for the model when one graph is known. We assume that there is an algorithm 
A that solves Graphlso u in polynomial time. We will use it to design another algorithm B to solve the 
Clique problem — given a graph G and a number k, find a clique of size k in G, or claim that it does not 
exist. 

For the given G, we construct a Graph lso u instance as follows: Let the known graph G2 = G and 
the unknown graph be G\ where V(G\) = {1,... ,n} and E{G\) = | 1 < % < j < k}, i.e., G\ 

is composed of a /c-clique with extra n — k isolated nodes. We now apply algorithm A on the instance 
(G\, G2) with the following specific verification oracle O upon a query: Given a bijection ir from V{G\) to 
V(G2), if it is indeed an isomorphism, then return Yes. Otherwise O returns a pair (i,j) that minimizes 
max{i,j} where the minimization is over all pairs (i,j) s.t. (i,j) G E(G\), and ^ EiGz)- If 

no such pair exists, it returns an arbitrary violated pair (for such a pair it must be max{i,j} > k). 

Note that A runs in polynomial time on the instance and O is efficiently implement able. 

We next construct an algorithm B for the /c-clique problem. 

Algorithm 4 Algorithm B for /c-clique 
Input: Graph G 

1: Gi <- ([n], \ l<i<j< k}), G 2 <- G. 

2: Run algorithm A on (Gi, G2) on oracle O. 

3: if (A outputs a bijection tt) or (O returns a pair (i,j) with max{i,j} > k on A's query tt) then 
4: Return "(7r(l), . . . , Tr(k)) is a clique in G". 
5: else 

6: Return "no /c-clique". 
7: end if 



If G is precisely a /c-clique plus n — k isolated nodes, then G\ is isomorphic to G = G2, and A finally 
returns a correct bijection; thus B also finds the clique. If G contains a /c-clique as well as some other 
edges, then G\ is not isomorphic to G and A finally outputs No. This looks undesirable since B may also 
output "no /c-clique" in the else branch. However, we claim that the verification oracle O always returns 
a pair i and j with max{i,j} > k before A can conclude with an answer No. Indeed, to conclude that 
Gi is not isomorphic to G, A has to detect at least one pair (i,j) with max{i, j} > k and (i,j) is not 
an edge in G±. (Otherwise, A only see edges within the first k nodes in G± and it is still possible in A's 
point of view that G\ is isomorphic to G. Thus A cannot make any decision yet.) But the only way that 
A detects such a pair (i,j) is when O returns a pair (i,j) where (-ir(i),ir(j)) G E(G) but (i,j) £ E{G\). 
By the design of our oracle, this can happen only if max{i, j} > k, as claimed. 

Once O returns a pair (i,j) with max{i, j} > k, all the edges (vr(i), vr(j)) in G exist; thus, B already 
finds a /c-clique and outputs it. 
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On the other hand, if G does not contain a fc-clique, then A never outputs a bijection. Further, for 
any n, there is at least one pair 1 < i < j < k, such that (i,j) G E{G\) and (7r(i), ^ E(G), 

and the oracle O as defined always returns one of such pairs. Hence, the algorithm B never outputs a 
/c-clique before A finishes, at which time B gets to the last line and outputs "no fc-clique". 

Finally, for the time cost, each execution of O takes time k 2 < n 2 and the number of queries to O 
in A is at most its time complexity t(n), so the total time on O is 0(t(n)n 2 ). Other time cost mainly 
includes the non-query part of A, which is at most t(n), so claimed time bound holds. □ 

We have the following immediate corollary. 

Corollary 14. For any given computation oracle L (which is a class of languages), Graphlso u G P V ' L if 
and only i/NP C P L . 

Proof. First, if NP C P L , which means P NP C P L , would imply Graphlso u G P VNP c P V ' L . Second, 
Theorem [131 will directly give us that if Graphlso u G P V ' L , then Clique G P L , which means NP C P L . □ 

It was shown in [17J that if Graphlso is NP-complete, then the polynomial hierarchy (PH) collapses 
to the second level. The proof can be easily adapted to show a slightly stronger result that PH collapses 
to the second level even if Graphlso is NP-complete under Turing reduction 10 !. This gives the following 
corollary. We include an elementary proof for completeness. 

Corollary 15. If Graphlso u G p v < Gra P hlso ; then the polynomial hierarchy (PH) collapses to the second 
level. 

Proof. It is sufficient to prove that £2 = II2. We will show the inclusion £2 Q II2, and the other 
direction is similar. For any formula (f>(x,y), where 1,1/6 {0, l} n , we want to construct another formula 
4>'(ri, . . . ,r^;x,ai, . . . , a&), where k and the lengths of all r/s and ai's are poly(n), s.t. 

3xVy <f>(x, y) = 1 44> V(ri . . . r k )3(x, ax... a k ) (f>'{n, . . . , r k , x, a 1} . . . , a k ) = 1. (12) 

Next is the construction. 

By Theorem[T3l if Graphlso u G pV^^' 50 , then NP C pGraphiso^ ^ any Np problem can be solved 
by a polynomial-time algorithm calling the Graphlso oracle at most k = poly(n) times. By flipping the 
answer, the algorithms can also solve co-NP problems. Note that \/y <f>(x,y) = 1 is a co-NP statement, 
so it can be solved by a polynomial-time algorithm with the Graphlso oracle. 

It is well-known that there is an AM protocol for GraphNonlso with perfect completeness and soundness 
error less than 2~ m , for any m polynomial in the length of the input. Also note that there is a trivial 
NP proof for Graphlso, which is a special case of an AM protocol with perfect completeness and perfect 
soundness. So we can design a protocol of 2k rounds to solve a co-NP-complete problem. Basically, the 
verifier simulates the algorithm mentioned in the above paragraph for the co-NP problem. When it comes 
to the i-th query to the Graphlso oracle, the verifier sends as if it is the AM protocol for GraphNonlso. 
Since it is a public-coin protocol, the verifier's code is deterministic except for the public random coins 
sent to the prover. So each time the prover knows the pair of graphs currently in the verifier's mind (as 
the input for the Graphlso oracle). So the prover is supposed to solve the graph isomorphism problem and 
to return the one-bit answer, followed by a proof of that answer. 

Now we will define a polynomial-time verification process V on input (r%, . . . ,r k ,x,a\, . . . ,a k ), and 
then take 4>' to be the formula induced by V as in the standard Cook-Levin reduction, and show Eq. (|12p , 
Let V denote the predicate which the assumed algorithm for the co-NP problem uses, after all queries 

10 Eric Allender later pointed out that this stronger result, as we guessed, was indeed known, e.g., in [68] . 
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to the Graphlso oracle, to decide acceptance/rejection. Now let V on (n, . . . , r k , x, at, . . . , a k ) be the 
following: Check each a, is a valid answer respect to rj, and if all pass, output V(rt, . . . , r k , x, at, . . . , a&). 

Since no matter whether the answer is or 1, the protocol always has perfect completeness. Therefore, 
for the Yes instances of the original £2 language, we have 



3xMy <j)(x,y) = 1 
=^3a;Vri3ai . ..Mr k 3a k V(x,(f>,rt, . . . ,r k , at, . . . , a k ) = 1 
=^3a;Vri . . .Vr k 3at . . . 3a k V'{x,<j),rx, . . . , r k , at, . . . , a k ) = 1 
=^Wi . . . Vr fc 3x3ai . . . 3a k V'(x,(j),rt, . . . ,r k ,at, . . . ,a k ) = 1 



(due to perfect completeness) 
(use the honest prover) 
(use the fixed x) 



On the other hand, for the No instances of the £2 language, we have 
\/x3y 4>{x,y) = 

=^Va;,for (1 — 2~ m )-fraction of ri,Vai, . . . , for (1 — 2~ m )-fraction of r k ,\/a k , 

V (x, (j>, n, . . . , r k , at, ■ ■ ■ , a k ) = (small soundness error for each round) 
=^fbr (1 - A;2"~ m )-fraction of (n, . . . ,r k ), VxVai . . . Va fc 

V (x, (j>, n, . . . , r k , at, ■ ■ ■ , a k ) = (union bound) 
=^3ri . . . 3r k Mx\/ai . . . \/a k V (x, (f>, r%, ■ ■ ■ , r k , at, ■ ■ ■ , a k ) = (whenever m > n + log 2 k) 



(13) 
(14) 
(15) 
(16) 



(17) 

(18) 

(19) 
(20) 



So if we pick m = n + [log 2 k] + 1, then Eq. (ll2p holds, as desired. 



□ 



6 Nash Equilibrium 

In a normal-form game, there are n players. Each player i has a strategy space Si and a payoff function 
Ui : St x • • • X S n i-)- Q, which gives the utility that i obtains for every strategy profile (si, . . . ,s n ) G 
St x • • • x S n . A joint probability distribution (pi, . . . ,p n ) on 5i x • • • x S n is called a (mixed) Nash 
equilibrium if for any player i and any probability distribution p • on , we have 

X] n^'( s -7') • u »( s i>---> s «) ^ ' n^J'C^J") ' u i( s ii--- > s n)- (21) 

(si,...,s„) j (si,...,s„) jj^i 

Note that the number of constraints given by the foregoing inequality is unbounded. It is well-known that 
a two-player game admits a mixed Nash equilibrium with polynomial size rationals, whereas games with 
three or more players may only have equilibria in irrational numbers [23]. The Nash problem is to find a 
Nash equilibrium in a normal-form game. 

In the unknown-input version of a given game, denoted by Nash u , the payoff functions Ui(-) are 
unknown. We can query a mixed strategy (pt, ■ ■ ■ ,p n ) each time. If it is not an equilibrium, then the 
oracle will return a player i and one of his better responses p\ where the foregoing inequality fails to hold 
(note that % and p\ are precisely the index of a violated constraint)^ Our trial and error model considers 
how fast a Nash equilibrium can be found from the viewpoint of a centralized authority, which is quite 
different from the learning models investigated in |31|, [73] whose focuses are on the strategic dynamics 
formed by the behavior of individual players. We have the following result. 

11 Note that the full set of strategies Si may also be unknown; that is, in the process of trials, we query a probability 
distribution over those strategies that we have already observed. A deviation from a player can be either from the known 
strategies or "new" unknown strategies. 
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Theorem 16. There is a polynomial-time algorithm solving Nash u for any two-player game, given a 
computation oracle solving Nash. 

Idea of the proof. The proof is built on the existence of a Nash equilibrium in any game |57| . Assume 
that each player has m strategies. There are a total of 2m 2 values in the two payoff matrices. Note that 
the Nash equilibrium solution space may not be convex; thus, we cannot employ the ellipsoid method to 
search for an equilibrium in the solution space. One observation is that the 2m 2 values in the matrices 
correspond to a point U in the space R 2m , which can also be seen as a degenerate polyhedron in M. 2m . 
For any given point X E M 2m2 , we can consider it as two payoff matrices of some game. If we compute a 
Nash equilibrium with respect to this game using the computation oracle and query it to the verification 
oracle, then the returned information (if it is not a Yes) actually gives us a hyperplane that separates X 
from the true point U. It is now tempting to claim that the problem is solved by the ellipsoid method. 
However, there is a remaining issue: in our problem, the solution polyhedron degenerates to a point and 
has volume 0. The standard approach in the ellipsoid method for handling such degenerated cases is to 
add perturbations to the constraints to introduce a positive volume of the feasible solution polyhedron. 
However, this approach is not applicable in our context, as we do not know the constraints explicitly. 
Luckily, we are able to employ a much more involved machinery developed by Grotschel, Lovasz, and 
Schrijver |34|. 135] . solving the strong nonemptiness problem for well-described polyhedra given by a strong 
separation oracle, to overcome this issue and thus solve the problem. □ 

Formal Proof of Theorem Assume without loss of generality that each player has m strategies. Notice 
that there are totally 2m 2 values in the payoff matrices given by u\ and U2', these values correspond to a 
point U in the space M 2m . If we are able to construct a separation oracle for U (which can also be seen 
as a degenerated polyhedron), then we can apply the ellipsoid method to find this point and thus solve 
the problem. Therefore the remaining problem is how to construct such a separation oracle in polynomial 
time. 

For any given point X G R 2m , consider it as two utility matrices xx,x 2 of another game. We can first 
compute a Nash equilibrium (pi,p 2 ) with respect to the two new utility matrices. Next we query this 
mixed strategy (pi,P2) to the verification oracle. If (pi,P2) is already a Nash equilibrium to the unknown 
utility matrices u\ and U2, then the verification oracle tells us so, and we have thus solved the problem. 
Now we assume that (pi,P2) is not a Nash equilibrium to the utility matrices u\ and u 2 . In this case we 
know that I / [/. Suppose without loss of generality that the verification oracle returns that the first 
player has a better response p^. This means that 

Pl(si) -P2(S 2 ) ■Ul(s 1 ,S 2 ) < P[(si) ■ P 2 (S2) ■ Ui(si,S 2 )- 

0l,S 2 ) («1|«3) 

Also notice that (pi,p 2 ) is a Nash equilibrium to utility matrices x\ and x 2 , thus we have 
^ Pi(si) ■ p 2 (s 2 ) ■ Xi(si, s 2 ) > ^2 p'i( s i) -P2{s2) ■ xi(si,s 2 ). 

This means that the vector (p\ — p'i) ®p 2 , whose (s±, s 2 )-entTy is (pi(si) — Pi(si))p 2 (s 2 ) , can serve as 
the returned vector for the strong separation oracle (separating point U from point X). Thus, we can use 
an approach developed by Grotschel, Lovasz, and Schrijver [HUGS] that based on the ellipsoid method to 
solve this problem. Formally, the approach can be used to provide a polynomial-time algorithm for the 
strong nonemptiness problem for well-described polyhedra K given by a strong separation oracle ([35J, 
Theorem 6.4.1). Here a strong nonemptiness problem is to decide whether K is empty, and if not, finding 
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a point in K. Our (degenerated) polyhedron U is a single point and is thus well-described. A strong 
separation oracle is one that on a given point y G K™ and a polyhedron X, finds a vector c such that 
c T y > max{c T a; : £ £ -ftT}. As argued above, we can construct such a strong separation oracle for point U 
easily in polynomial time (thanks to the computation oracle for solving Nash); thus, we can identify the 
exact value of these two utility matrices u\ and U2 (or find a Nash equilibrium in some middle step). Once 
we find «i and U2, we call the computation oracle one more time to compute a Nash equilibrium. □ 

We would like to comment that here the polyhedron U is degenerated and has volume 0. In the 
known-input case, one can use the standard perturbation approach in the ellipsoid method to introduce 
a positive volume to U for handling this issue. However, the approach is not applicable in our context, as 
we do not know the constraints explicitly. Therefore, we have to use a much more involved machinery in 
[3U[35], as applied in the above proof, to find halfspaces that contain U, and do a sequence of dimension 
reductions. Fortunately and very interestingly, what is provided by the verification oracle just fits what 
the method requires. 

For completeness, we briefly describe the idea of this general method. Let F denote the feasible 
solution polyhedra. Given the separation oracle provided by the verification oracle, we use the ellipsoid 
method to ask queries iteratively: Initially we pick an ellipsoid that covers the entire domain [0, N] n 
and query the center of the ellipsoid. If a constraint is violated from the verification oracle, we establish 
a separation oracle and compute the next ellipsoid. (Note that a remarkable property of the ellipsoid 
method is that we do not even need to know the explicit expression of the violated constraint, and a 
separation oracle suffices for the algorithm to continue.) The process continues until either we find a 
point which is in F or the volume of the ellipsoid is sufficiently small such that F must have volume 0. 

Note that if the system of inequalities has a solution, the numerator and denominator of all its 
components are bounded by (nN) n . Thus, there is a lower bound on the volume of F if it is positive. 
After the volume of the ellipsoid gets smaller than that lower bound, which can be done in polynomial 
to n and logA r number of steps, we can conclude that F is not full-dimensional, i.e., all points in F are 
lie on a hyperplane H. If we can find the hyperplane H in polynomial time, we know an extra (explicit) 
constraint and can reduce our problem to an (n — l)-dimensional case; then we can use the same method 
to solve it recursively. 

Thus the remaining problem is how to identify the hyperplane H in polynomial time. This problem 
is solved by Grotschel, Lovasz, and Schrijver in [34] . The general idea is that, having the ellipsoid with 
small enough volume that contains the solution polyhedra F, the ellipsoid must be very "thin" in the 
direction perpendicular to H. That is to say, if we take the shortest axis of this ellipsoid, let u be the unit 
vector which is parallel to this axis and v be the center of the ellipsoid, the hyperplane u T x = u T v must 
be very close to our target hyperplane H. Then next we use the simultaneous diophantine approximation 
algorithm, which is a technique to round real numbers by rational numbers with relatively small sized 
denominator, to round the coefficients of u T x = u T v; this will finally give us the hyperplane H . 

Although the aforementioned claim applies only to two-player games, our approach can also be gen- 
eralized to n players to obtain an e-approximate mixed Nash equilibrium for any constant e > 0. (Note 
that we cannot hope to compute an exact Nash equilibrium when n > 3, as such a solution may consist 
of irrational numbers.) However, there is one potential issue: the input size of a game can be as large 
as 0(m n ), where m is the number of strategies of each player. Thus, for general games, our algorithm 
may require running time polynomial to 0(m n ) (which is still polynomial in the input size). However, for 
some multi-player games that admit concise representations, e.g., graphical games [35] on constant degree 
graphs, we can find an e-approximate Nash equilibrium in time polynomial to m and n. 

Our result implies that even if players are not completely aware of the rules of a game, we can still 
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find a Nash equilibrium efficiently. Further, even if a Nash equilibrium has been achieved, the game itself 
can still remain a mystery (because beyond this point, the verification oracle cannot return any further 
information). The Internet provides one such example, as Scott Shenker remarked: "The Internet is an 
equilibrium, we just have to identify the game" |62j . 

In addition, we note that our approach can also be adopted to solve some other similar problems such 
as correlated equilibrium in games and competitive equilibrium in matching markets with prices (the 
details are quite similar to Nash u and thus are omitted here). 

7 Core of Cooperative Games 

In a cost-sharing game, we are given a set A of n agents, and a cost function c : 2^ i— > M + U {0}. 
Basically, the cost function gives the cost for any subset S C A in order to let every agent in S be served. 
For example, c(S) can be the cost to build a network that connects everyone in set S to the Internet. 
We assume that c(0) = and the function is monotone, i.e., c(S) < c(T) if S C T. We say a vector 
a = (cti)i£A £ ^ n is in the core of the game if it satisfies the following two conditions: 

• EieA«» = C ( A )- 

• Sies ai — c (^) f° r ever y S C A. 

Core is a central notion in cooperative game theory. The classic Bondareva-Shapley Theorem [TBI [70] 
says that the core of a cooperative game is non-empty if and only if the cost function is fractionally 
subadditive. (A function is fractionally subadditive if there is a set of linear functions /i, • • • ,/ m such 
that v(S) = max |/i(5), /2(5), . . . , / m (5)} for any S C A.) Fractionally subadditive functions form a 
pretty general class which includes, e.g., additive functions, gross substitutes functions, and submodular 
functions as special cases [5T] . 

In the corresponding unknown-input problem, denoted by Core u , the cost function c(-) is unknown; the 
information that we have is the number of agents n and an integer N which bounds the encoding length 
of every c(S). (We assume that each c(S) is given by two rational numbers presenting its numerator 
and denominator, respectively, whose values are therefore bounded by 2^.) We can propose a vector 
a G [0, N] n . If it is in the core, the verification oracle returns a Yes answer; otherwise, it returns the index 
of a violated constraint. Here the set of constraints contains precisely the linear constraints used to define 
the core, except that we replace the inequality YlieA a i = C ( A ) by two inequalities: YlieA a i — C ( A ) an< ^ 

Theorem 17. There is an algorithm solving the Core u problem in time polynomial in the input size. 

Note that when the cost function is additive, i.e., X^eA C W = c ( A )-> there is a unique solution to 
the core, i.e., Qj = c(i). An implication of our result is that we are able to identify these number c(i)'s 
precisely given the verification oracle. Further, together with Bondareva-Shapley Theorem |16} I70|. our 
result immediately implies that we are able to determine if a given function is in the class of fractionally 
subadditive in polynomial trials. 

12 This is necessary to admit a polynomial time algorithm. For instance, when there is only one agent, the problem 
degenerates to find a given unknown rational number using queries. If the query is of the form "Is x = y?" , it will take an 
exponential number of queries in the worst case; but if the query is of the form "Is x < y?" , polynomial time algorithms are 
known [61][50]. 
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of Theorem \17\ According to the definition, the core of a cost-sharing game is just the set F of solutions 
described by the following system of linear inequalities: 

< c(A). 

i&A 

< c(S), VScA. 

ieS 

This is a system of linear inequalities with n variables and 2 n + 2 constraints. 

Each time when we propose a vector a, either we know that a £ F, which implies that a is in the 
core and we are done), or we get a subset S where YlieS ai > c (^)- (The case that the first inequality 
is violated can be handled similarly.) Note that the value of c(S) is still unknown to us, but we are able 
to get a strong separation oracle for (F, a). Because our polyhedron F has short representation and is 
thus well-described. Hence again we can apply the ellipsoid algorithm either to find a point x G F or to 
conclude that F is empty, solving the problem Core u . □ 

8 Subset Sum 

Given a set S = {a\, . . . ,a n } of n integers, the subset sum problem is to find a partition of S into two 
subsets S\ and 52 such that X^aeSi a = J2bes 2 ^> or re P° r t that such a partition does not exist. 

In the unknown input version of subset sum problem, denoted by SubsetSum u , the values of these n 
integers are unknown to us. Each time we can propose a partition Si and S^- If it is indeed a solution to 
the subset sum problem, the verification oracle will return Yes. Otherwise, the oracle will return which 
subset has a larger total value. That is, the violation is one of the following two constraints. 

• J2aes 1 a > Efc G S 2 b 

• Eae Sl a ^ Ebes 2 b 

Theorem 18. The SubsetS um u problem has an exponential lower bound on trial complexity. 

Proof. Consider the following instance of SubsetSum: S = {ai, 02, • • • , a2n} of In integers, which can be 
divided into three categories: 

• ai = M + n + 2. 

• 02 = ■ ■ ■ = a n = M + 2. 

• a n+ i = ■ ■ ■ = a 2n = M + 3. 

Here M is a sufficiently large integer, such that in any partition, if the two sets have different sizes 
(number of integers), the larger set will always have a larger sum. Thus, it is easy to see that the only 
valid partition is given by Si = {ai, 02, . . . , a n } and S2 = {a n +i, ■ ■ ■ > 02n}- 

Given an algorithm for SubsetSum u , since the instance S has a valid and unique partition solution, 
it should be able to find out the subset {a n+ i, . . . , a2 n } precisely, i.e., the exact partition (Si, £2). For 
any query (Ti^Tq), if T\ and T2 have different sizes, the oracle will always return the set with bigger size 
(which has a larger sum), and we cannot derive any information from this query. If Ti and T2 have the 
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same size but are not exactly S\ and S2, it is always the case that the set containing a\ has a larger sum. 
Thus, the only information we can derive is a subset of candidates of a±. Therefore, in order to find the 
subset {a n +i, . . . ,a2 n }, even if we already know the membership of a\, in the worse case one needs as 
much as i^™^ 1 ) queries; this gives the desired exponential lower bound. □ 

9 Concluding Remarks 

In this paper, we propose a trial and error model to investigate search problems with unknown input. 
We consider a number of natural problems, and show that the lack of input knowledge may introduce 
different levels of extra difficulty in finding a valid solution. Our complexity results range from polyno- 
mially solvable, to NP-complete and exponential. Our model and results demonstrate the value of input 
information in solution finding from the computational complexity viewpoint. 

The present work showcases a number of algorithms and lower bounds. Meanwhile, a number of 
important questions are left for future exploration. Closing the small gaps in Theorem [2] and examining 
more CSP problems are the obvious and specific ones. The following is a list of more problems and 
directions for further research. 

• Information processing on hidden inputs is a common phenomenon in many scenarios, and the 
present work tries to address the related computational complexity issues in a specific and natural 
framework. What other general frameworks could be employed for systematic studies of hidden 
inputs from an algorithmic perspective? 

• Our complexity results focus on either the trial or the time cost. It would be intriguing to consider 
the tradeoff between them. For instance, in Sorting u and StableMatching u , our deterministic upper 
bounds O(nlogn) and 0(n 2 log n) for trial complexity are established by exponential-time algo- 
rithms. If we only allow polynomial time computation, then we do not have any bound better than 
0(n 2 ) and 0(n 3 ) for Sorting u and StableMatching u , respectively. (Note that the classic argument of 
graph entropy for sorting under a partial order [H] is not directly applicable here, as the allowed 
queries there are of the standard form of pair comparison.) 

On the lower bound side, a natural question is whether any lower bound better than O(nlogn) 
and J7(n 2 logn) can be proven for Sorting u and StableMatchingu with polynomial time computation 
power. Note that the bound, if possible, would probably be very difficult to prove because it implies 
that #P 7^ FP and thus P 7^ PP. (If #P = FP, then counting linear extensions, as a #P- 
complete problem, can be computed in polynomial-time, which makes our algorithms for Sorting u 
and StableMatchingu also in polynomial time.) 

• It is well known in decision tree complexity that deterministic and randomized complexities can be 
polynomially separated [22], and a fundamental open question is whether the gap exhibited by the 
NAND tree [67] is the largest possible. What separation between deterministic and randomized trial 
complexities could we have in our model? This question could also be considered in the polynomial- 
time computation framework. 

• An algorithm in our model can access two oracles, verification and computation. In this paper, 
we consider only the complexity that interacts with the verification oracle. It is natural to ask 
about the query complexity of the other oracle (the problem is of particular importance when the 
computational complexity of the problem itself is large). 
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